[PATCH v11 63/65] drm_buddy: fix 64-bit truncation in power-of-2 rounding

Jim Cromie posted 65 patches 3 weeks, 3 days ago
[PATCH v11 63/65] drm_buddy: fix 64-bit truncation in power-of-2 rounding
Posted by Jim Cromie 3 weeks, 3 days ago
The standard roundup_pow_of_two() and rounddown_pow_of_two() macros use
unsigned long internally, which on 32-bit architectures (like arm32) is
a 32-bit type.

drm_test_buddy_alloc_exceeds_max_order() uses the on a u64 value,
where they silently truncate the 10GB allocation, giving unexpected
success in DRM-CI.  (see below the snip).

Fix this by replacing the standard macros with safe 64-bit
power-of-two calculations using ilog2().

Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
---

    [23:19:40] [PASSED] drm_test_buddy_alloc_clear
    [23:19:40] [PASSED] drm_test_buddy_alloc_range_bias
    [23:19:41] [PASSED] drm_test_buddy_fragmentation_performance
    [23:19:41]     # drm_test_buddy_alloc_exceeds_max_order: EXPECTATION FAILED at drivers/gpu/drm/tests/drm_buddy_test.c:889
    [23:19:41]     Expected err == -22, but
    [23:19:41]         err == 0 (0x0)
    [23:19:41] ------------[ cut here ]------------
    [23:19:41] WARNING: drivers/gpu/drm/drm_buddy.c:405 at drm_buddy_fini+0x114/0x1b8, CPU#0: kunit_try_catch/74
    [23:19:41] CPU: 0 UID: 0 PID: 74 Comm: kunit_try_catch Tainted: G                 N  7.0.0-rc1-gdfb0bcedd08a #1 VOLUNTARY
    [23:19:41] Tainted: [N]=TEST
    [23:19:41] Hardware name: Generic DT based system
    [23:19:41] Call trace:
    [23:19:41]  unwind_backtrace from show_stack+0x10/0x14
    [23:19:41]  show_stack from dump_stack_lvl+0x3c/0x4c
    [23:19:41]  dump_stack_lvl from __warn+0xe8/0x1c4
    [23:19:41]  __warn from warn_slowpath_fmt+0xa4/0xc0
    [23:19:41]  warn_slowpath_fmt from drm_buddy_fini+0x114/0x1b8
    [23:19:41]  drm_buddy_fini from drm_test_buddy_alloc_exceeds_max_order+0x1c8/0x36c
    [23:19:41]  drm_test_buddy_alloc_exceeds_max_order from kunit_try_run_case+0x78/0x1c8
    [23:19:41]  kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x1c/0x34
    [23:19:41]  kunit_generic_run_threadfn_adapter from kthread+0x108/0x134
    [23:19:41]  kthread from ret_from_fork+0x14/0x28
    [23:19:41] Exception stack(0xf0bd5fb0 to 0xf0bd5ff8)
    [23:19:41] 5fa0:                                     00000000 00000000 00000000 00000000
    [23:19:41] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    [23:19:41] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
    [23:19:41] ---[ end trace 0000000000000000 ]---
    [23:19:41]     # drm_test_buddy_alloc_exceeds_max_order: drivers/gpu/drm/drm_buddy.c:406: buddy_fini() root
    [23:19:41] ------------[ cut here ]------------
    [23:19:41] WARNING: drivers/gpu/drm/drm_buddy.c:414 at drm_buddy_fini+0x1b4/0x1b8, CPU#0: kunit_try_catch/74
    [23:19:41] CPU: 0 UID: 0 PID: 74 Comm: kunit_try_catch Tainted: G        W        N  7.0.0-rc1-gdfb0bcedd08a #1 VOLUNTARY
    [23:19:41] Tainted: [W]=WARN, [N]=TEST
    [23:19:41] Hardware name: Generic DT based system
    [23:19:41] Call trace:
    [23:19:41]  unwind_backtrace from show_stack+0x10/0x14
    [23:19:41]  show_stack from dump_stack_lvl+0x3c/0x4c
    [23:19:41]  dump_stack_lvl from __warn+0xe8/0x1c4
    [23:19:41]  __warn from warn_slowpath_fmt+0xa4/0xc0
    [23:19:41]  warn_slowpath_fmt from drm_buddy_fini+0x1b4/0x1b8
    [23:19:41]  drm_buddy_fini from drm_test_buddy_alloc_exceeds_max_order+0x1c8/0x36c
    [23:19:41]  drm_test_buddy_alloc_exceeds_max_order from kunit_try_run_case+0x78/0x1c8
    [23:19:41]  kunit_try_run_case from kunit_generic_run_threadfn_adapter+0x1c/0x34
    [23:19:41]  kunit_generic_run_threadfn_adapter from kthread+0x108/0x134
    [23:19:41]  kthread from ret_from_fork+0x14/0x28
    [23:19:41] Exception stack(0xf0bd5fb0 to 0xf0bd5ff8)
    [23:19:41] 5fa0:                                     00000000 00000000 00000000 00000000
    [23:19:41] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    [23:19:41] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
    [23:19:41] ---[ end trace 0000000000000000 ]---
    [23:19:41] [FAILED] drm_test_buddy_alloc_exceeds_max_order
    [23:19:41]     # drm_buddy: Testing DRM buddy manager, with random_seed=0xacce106c
    [23:19:41]     # module: drm_buddy_test
    [23:19:41] # drm_buddy: pass:8 fail:1 skip:0 total:9
---
 drivers/gpu/buddy.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/buddy.c b/drivers/gpu/buddy.c
index 52686672e99f..ed4d33a30687 100644
--- a/drivers/gpu/buddy.c
+++ b/drivers/gpu/buddy.c
@@ -1091,7 +1091,7 @@ static int __alloc_contig_try_harder(struct gpu_buddy *mm,
 	u64 modify_size;
 	int err;
 
-	modify_size = rounddown_pow_of_two(size);
+	modify_size = 1ULL << ilog2(size);
 	pages = modify_size >> ilog2(mm->chunk_size);
 	order = fls(pages) - 1;
 	if (order == 0)
@@ -1318,7 +1318,7 @@ int gpu_buddy_alloc_blocks(struct gpu_buddy *mm,
 
 	/* Roundup the size to power of 2 */
 	if (flags & GPU_BUDDY_CONTIGUOUS_ALLOCATION) {
-		size = roundup_pow_of_two(size);
+		size = 1ULL << (ilog2(size - 1) + 1);
 		min_block_size = size;
 		/*
 		 * Normalize the requested size to min_block_size for regular allocations.
-- 
2.53.0
Re: [PATCH v11 63/65] drm_buddy: fix 64-bit truncation in power-of-2 rounding
Posted by Louis Chauvet 2 weeks, 3 days ago
On Fri, 13 Mar 2026 07:20:28 -0600, Jim Cromie <jim.cromie@gmail.com> wrote:
> [...]
> drm_test_buddy_alloc_exceeds_max_order() uses the on a u64 value,
> where they silently truncate the 10GB allocation, giving unexpected
> success in DRM-CI.  (see below the snip).
> 
> Fix this by replacing the standard macros with safe 64-bit
> power-of-two calculations using ilog2().

This is a general DRM bug, if you send a new iteration, can you move it at
then start so it can be applied easly?

>
>
> diff --git a/drivers/gpu/buddy.c b/drivers/gpu/buddy.c
> index b27761246d4b..ff158cc1d27e 100644
> --- a/drivers/gpu/buddy.c
> +++ b/drivers/gpu/buddy.c
> @@ -915,7 +915,7 @@ static int __alloc_contig_try_harder(struct gpu_buddy *mm,
>  	u64 modify_size;
>  	int err;
>  
> -	modify_size = rounddown_pow_of_two(size);
> +	modify_size = 1ULL << ilog2(size);

Thanks for catching this issue!

To avoid this kind of issue later / in other parts of the kernel, maybe you
can change the macro itself to properly handle u64? I am thinking about
something similar to ilog2[1]:

( \
	(sizeof(n) <= 4) ?		\
	__rounddown_pow_of_two_u32(n) :	\
	__rounddown_pow_of_two_u64(n)	\
)

[1]:https://elixir.bootlin.com/linux/v6.19.8/source/include/linux/log2.h#L156-L164

-- 
Louis Chauvet <louis.chauvet@bootlin.com>
Re: [PATCH v11 63/65] drm_buddy: fix 64-bit truncation in power-of-2 rounding
Posted by jim.cromie@gmail.com 2 weeks, 2 days ago
On Fri, Mar 20, 2026 at 10:43 AM Louis Chauvet
<louis.chauvet@bootlin.com> wrote:
>
> On Fri, 13 Mar 2026 07:20:28 -0600, Jim Cromie <jim.cromie@gmail.com> wrote:
> > [...]
> > drm_test_buddy_alloc_exceeds_max_order() uses the on a u64 value,
> > where they silently truncate the 10GB allocation, giving unexpected
> > success in DRM-CI.  (see below the snip).
> >
> > Fix this by replacing the standard macros with safe 64-bit
> > power-of-two calculations using ilog2().
>
> This is a general DRM bug, if you send a new iteration, can you move it at
> then start so it can be applied easly?
>

Yes.  I also sent it separately so it could be just picked up.

> >
> >
> > diff --git a/drivers/gpu/buddy.c b/drivers/gpu/buddy.c
> > index b27761246d4b..ff158cc1d27e 100644
> > --- a/drivers/gpu/buddy.c
> > +++ b/drivers/gpu/buddy.c
> > @@ -915,7 +915,7 @@ static int __alloc_contig_try_harder(struct gpu_buddy *mm,
> >       u64 modify_size;
> >       int err;
> >
> > -     modify_size = rounddown_pow_of_two(size);
> > +     modify_size = 1ULL << ilog2(size);
>
> Thanks for catching this issue!
>
> To avoid this kind of issue later / in other parts of the kernel, maybe you
> can change the macro itself to properly handle u64? I am thinking about
> something similar to ilog2[1]:
>
> ( \
>         (sizeof(n) <= 4) ?              \
>         __rounddown_pow_of_two_u32(n) : \
>         __rounddown_pow_of_two_u64(n)   \
> )
>
> [1]:https://elixir.bootlin.com/linux/v6.19.8/source/include/linux/log2.h#L156-L164
>

I will take a look, but if you have an itch, dont hesitate.

> --
> Louis Chauvet <louis.chauvet@bootlin.com>